FaLLenSKiLL1/CVE-2024-6678

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2024-6678 in GitLab by triggering pipeline schedules as an arbitrary user. It includes reconnaissance, schedule triggering via REST and GraphQL APIs, a protected-ref bypass using ambiguous tags, and an optional CI YAML patching step to exfiltrate environment variables.

Backdoor review

No backdoor observed in reviewed code

The PoC script (CVE-2024-6678-poc.py) and README.md implement and document a legitimate exploit for CVE-2024-6678, which triggers GitLab pipeline schedules as an arbitrary user. The code performs only the described exploit actions: authenticating, enumerating schedules, triggering pipelines via REST/GraphQL, optionally patching .gitlab-ci.yml for CI variable exfiltration, and restoring the original file. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit is present.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareGitLab CE/EE
Attack typesauthentication bypassprivilege escalationinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively triggers a vulnerability (CVE-2024-6678) to execute pipeline schedules as an arbitrary user, including optional steps to exfiltrate data and bypass protections. This constitutes exploit code.

CVE-2024-6678-poc.py:1CVE-2024-6678-poc.py:98-116CVE-2024-6678-poc.py:120-146CVE-2024-6678-poc.py:283-285

Requirements

  • Attacker must have a GitLab personal access token with Developer-level access to the target project.CVE-2024-6678-poc.py:289-290
  • Target project must have at least one active pipeline schedule.CVE-2024-6678-poc.py:353-357

Observed behavior

  • Authenticates to the GitLab instance using the provided token and retrieves the attacker's user ID and username.CVE-2024-6678-poc.py:343-350
  • Enumerates all pipeline schedules for the target project.CVE-2024-6678-poc.py:353-363
  • Selects a target schedule, preferring those owned by other users.CVE-2024-6678-poc.py:366-389
  • Triggers the selected pipeline schedule via the REST API or GraphQL mutation, causing the pipeline to run as the attacker instead of the schedule owner.CVE-2024-6678-poc.py:443-490
  • Optionally patches .gitlab-ci.yml on the target branch to exfiltrate all environment variables to an attacker-controlled URL.CVE-2024-6678-poc.py:202-210CVE-2024-6678-poc.py:431-441
  • Optionally performs a protected-ref bypass by creating a tag with the same name as a protected branch to circumvent branch protection policies.CVE-2024-6678-poc.py:153-195CVE-2024-6678-poc.py:408-424
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exfiltration Url Parameter
--exfil-urlThe script accepts an attacker-controlled URL to receive exfiltrated CI variables, which is part of the documented exploit workflow.CVE-2024-6678-poc.py:295-296
Ci Yaml Patch
Overwrites .gitlab-ci.yml with exfiltration payload and restores itThe script temporarily replaces the CI configuration to dump environment variables to the attacker's URL, then attempts to restore the original file. This is part of the documented exploit.CVE-2024-6678-poc.py:202-276
Authentication Token Usage
Attacker's personal access token passed via --tokenThe script uses the provided token to authenticate API requests, which is necessary for the exploit.CVE-2024-6678-poc.py:289-290
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files from the repository; other files, if any, were not provided.
  • The artifact's behavior is inferred from static analysis of the source code; the code was not executed.
  • The README.md file contains embedded images that are not rendered in the text evidence, limiting full understanding of the visual output.
  • Only the two text files (CVE-2024-6678-poc.py and README.md) were reviewed; no binary files were present.
  • The review does not assess whether the exploit actually works or is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1